GDPR lawful basis selector for AI processing
Every time you process personal data through an AI system you need a lawful basis under GDPR Article 6 — and you must choose it before you start, document it, and explain it in your privacy notice. Many teams default to “consent” out of habit, which is often the wrong and most fragile choice. This selector walks a decision tree based on your purpose, data type, and relationship to the people involved, and recommends the most appropriate basis with a rationale.
How it works
You answer three questions: the purpose of the processing (delivering a service, improving/training models, marketing, safety, legal compliance, or a public task), the type of data involved (ordinary or special-category), and your relationship to the data subjects (your customer, your employee, or the general public). The tool applies the Article 6 logic — for example, processing necessary to deliver a contracted service points to contract, broad model improvement points to legitimate interests (with a balancing test), and marketing to people you have no other relationship with points to consent. It flags when special-category data triggers an additional Article 9 condition.
The six bases and when each fits AI processing
Consent (Article 6(1)(a)) requires that processing is genuinely optional — the individual has a real choice, can withdraw at any time without penalty, and consented to that specific processing. Consent is the right basis when people have a true opt-in decision: for example, volunteering their data to improve your AI model, or opting into personalisation that is not needed to receive the service. It is the wrong basis when processing is necessary to deliver the service — consent freely given cannot be obtained when refusal breaks the product the person signed up for.
Contract (Article 6(1)(b)) applies when processing is necessary to perform a contract the person entered or to take steps before entering one. This is the right basis for using customer data to power an AI recommendation engine that is a core part of the service they contracted for. The test is necessity — if you could deliver the contract without processing this data, this basis does not hold.
Legitimate interests (Article 6(1)(f)) is the most flexible basis and the one most commonly misapplied. It requires passing a three-part test: your interest is legitimate (it is real and lawful), the processing is necessary for that interest (you could not achieve it another way), and your interest is not overridden by the individual’s rights given the context and their reasonable expectations. For AI, this often fits fraud detection, security monitoring, and internal analytics. It requires a documented balancing test — it is not a catch-all for “we have a business reason.”
Legal obligation (Article 6(1)(c)) applies when you must process data to comply with a specific law. For example, retaining financial transaction logs to meet anti-money-laundering rules.
Vital interests (Article 6(1)(d)) is a narrow basis for situations involving risk to someone’s life. Rarely relevant outside healthcare contexts.
Public task (Article 6(1)(e)) applies to public authorities and organisations exercising official functions.
The special-category layer
If your AI processing touches health, biometric, genetic, racial or ethnic origin, political opinion, religious belief, trade union membership, sexual orientation, or criminal record data, you need an Article 6 basis and a separate Article 9 condition. The most common Article 9 conditions for AI are explicit consent (Article 9(2)(a)) and substantial public interest (Article 9(2)(g)).
Notes and documentation
Pick the basis that genuinely fits the processing, not the one that is easiest to claim. Record your chosen basis and the specific reasoning in your records of processing activities before you begin processing — not retrospectively. Explain the basis and purpose clearly in your privacy notice. If you are relying on legitimate interests, document the balancing test in writing. Treat this selector as a decision aid to structure your thinking; confirm the final choice with a data protection specialist for high-risk or large-scale processing.